What is a risk matrix?
A risk matrix is a two-dimensional table. One axis represents the probability or frequency with which the damage may occur, and the other represents the severity or seriousness of its consequences. Each resulting cell represents a level of risk (for example, trivial, tolerable, moderate, significant, or intolerable) and is associated with a course of action: from requiring no additional measures to demanding that work be stopped until the risk is reduced.
Its usefulness lies in comparability. When the risks of a center are assessed using the same scale, the matrix allows them to be ranked, priorities to be justified, and why some measures take precedence over others to be explained to management and employee representatives. It also facilitates monitoring: when reassessing after implementing a measure, the shift from one cell to another shows whether the control has been effective.
In Spain, the matrix is not mandated by regulations. The Prevention Services Regulations require an evaluation procedure with objective criteria and allow the use of methods or criteria included in standards, INSST guidelines, or international standards when specific regulations do not exist. The probability-severity matrix proposed by the INSST in its 2000 risk assessment document is the most widely used, but it coexists with agent-specific methods and more granular matrices such as that of NTP 330 .
Differences between risk matrix, risk assessment and IPER
The three terms are often used as synonyms, especially in Latin America, but they describe different things.
- Risk matrix. Assessment and presentation tool: cross-references probability and severity, assigns levels and priorities. It does not identify hazards on its own nor does it replace technical analysis.
- Risk assessment. A complete process required by regulations: hazard identification, risk estimation and evaluation, and conclusion regarding the necessary measures. The matrix is just one tool within the assessment phase.
- IPER or IPERC. Common name in Peru, Colombia, Chile and other countries for the document that includes hazard identification, risk assessment and, in its IPERC variant, controls; it is normally presented in a matrix format by position or task.
Practical rule: the matrix answers the question of how much risk there is and how urgently action is needed; the assessment also answers the question of what hazards exist, who they affect, and what specific measures will be taken. A matrix without rigorous identification and planned measures is a blank canvas devoid of preventive content.
How to build and use a risk matrix
The construction requires defining the scales beforehand. Probability is usually expressed in three or five levels (for example, low, medium, and high, or from improbable to almost certain), and severity in just as many (from slightly harmful to extremely harmful, or from minor injury without time off to death). Each level must be described with verifiable criteria, not just adjectives, so that two different technicians can arrive at similar results.
With the scales defined, the use of the matrix follows a sequence:
- Start with a complete hazard identification by position, task or process, including the people exposed and the existing measures.
- Estimate for each hazard the probability of damage occurring, considering the frequency and duration of exposure and the reliability of current controls.
- Estimate the severity of the most likely damage, not the worst imaginable nor the most benign, and document the criterion.
- Place the risk in the corresponding cell and read the level and the associated action.
- Record who has assessed, with what information and when, and link each unacceptable risk to the action plan.
- Re-evaluate after applying measures, in the event of changes or damage to health, and verify that the level actually decreases and not just on paper.
The INSST Basic Guidelines warn that semi-quantitative methods help to prioritize, but do not replace legal criteria or limit values: if a standard sets a limit or an obligation, the matrix cannot lower the priority below what the law requires.
Most commonly used types of matrices
There is no single valid matrix. The most common ones used in preventive practice are:
- INSST 3×3 Matrix. Low, medium, or high probability versus slightly harmful, harmful, or extremely harmful severity; produces five risk levels, from trivial to intolerable, with associated actions and timelines. It is the basis of most general assessments in Spain.
- 5 x 5 Matrix. Five levels on each axis, common in certified management systems and large organizations; it allows for better discrimination between moderate risks, but requires more precise criteria to avoid introducing false accuracy.
- NTP 330 level system. Instead of estimating the probability directly, it breaks it down into deficiency level (obtained with checklists) and exposure level; combined with the consequence level, they generate a risk level and an intervention level.
- IPER and IPERC matrices. Position or task formats used in Peru, Colombia, Chile or Mexico that integrate in rows each hazard with its risk, its assessment and the existing or proposed controls; in Peru, the reference formats of the management system include this matrix.
- Agent-specific matrices. For chemical, ergonomic, or psychosocial risks, the general matrix is replaced or supplemented with specific methods (e.g., qualitative assessment of chemical agents or validated ergonomic methods), because the probability and severity are estimated with different parameters.
The choice depends on the size of the organization, the risk level of the activity, and the management culture. What matters is not the number of cells, but that the scales are defined, applied consistently, and lead to informed decisions.
Limitations and common errors
The matrix simplifies a complex reality and can lead to errors if used without judgment:
- Confusing scale with measurement: two risks in the same cell may require very different measures of cost and urgency.
- Estimating probability without exposure data or incident history, or severity with the worst imaginable case, distorts priorities.
- Lowering the risk level based solely on the existence of PPE or a procedure, without verifying that they are used and working.
- Apply a general matrix to agents that require specific measurement or methods, such as noise, chemical agents, or vibrations.
- Presenting the matrix as a final document, without the measures, deadlines and responsible parties required by preventive planning.
- Do not review it after changes in equipment, processes, organization, or after health damage.
Proper use documents the hypotheses of each assessment, compares the results with legal and technical requirements, and retains previous versions to maintain traceability of how each risk has evolved.
Practical example
Situation: A food packaging plant updates the assessment of the palletizing line after two incidents without lost-time injury in six months.
- Hazards identified: Access to the palletizing arm movement area during jams; wet floor next to the washing area; manual handling of 20 kg bags at the feeding station.
- Assessment in the matrix. Entrapment in the palletizer: medium probability (jams are resolved several times per shift) and extremely harmful severity, significant level. Fall on wet floor: high probability and harmful severity, significant level. Overexertion: high probability and harmful severity, significant level, with specific ergonomic assessment pending.
- Measures, in order of priority: Interlocking of access with safe stopping before clearing machinery jams; procedure and training; physical separation of the washing area and non-slip footwear; mechanical aids for feeding bags.
- Follow-up. Re-evaluation of the three cells after implementation, with verification of actual use of the controls; review of the matrix in the event of any new incident.
Regulatory framework in Spain and international references
- Royal Decree 39/1997, articles 3 to 7. They define the evaluation as the process of estimating the magnitude of unavoidable risks, require a procedure with objective criteria and allow the use of methods, standards and technical guides when there is no specific regulation; the matrix is one of those methods, not an obligation.
- Law 31/1995, articles 15 and 16. They establish the principles of preventive action and the obligation to assess risks and plan measures; the prioritization produced by the matrix must respect these principles.
- Basic guidelines for the assessment of occupational risks (INSST, 2021) . They place risk assessment as a stage subsequent to identification and warn of the limitations of semi-quantitative methods in relation to legal requirements.
- Ministerial Resolution 050-2013-TR (Peru) . Approves the reference formats for the records of the OSH management system, including the hazard identification, risk assessment and control matrix format (IPERC); it is the Peruvian framework, not applicable in Spain.
In Colombia, Chile, and Mexico, the management system also requires a documented methodology for hazard identification and risk assessment, with formats specific to each country. ISO 45001 and ISO 31010 describe assessment techniques, but they are voluntary technical references.
